@promptowl/contextnest-community 1.16.1 → 1.17.0

package/dist/{chunk-L7UCMGWZ.js → chunk-SNFGU5Q7.js}

@@ -993,7 +993,8 @@ import { v4 as uuid } from "uuid";
 import {
   NestStorage as NestStorage2,
   GraphQueryEngine,
-  VersionManager
+  VersionManager,
+  DocumentNotFoundError
 } from "@promptowl/contextnest-engine";
 import { createEngineApi } from "@promptowl/contextnest-engine/api";
 
@@ -1060,39 +1061,88 @@ var FlatNestStorage = class extends NestStorage {
 
 // src/nodes/engine.ts
 var DISCOVERY_TTL_MS = 3e4;
-var DOCUMENT_WRITERS = [
-  "writeDocument",
-  "deleteDocument",
-  "writeVaultFile",
-  "init"
-];
+var isLive = (node) => node.frontmatter.status !== "rejected";
+var DERIVED_VAULT_FILES = /* @__PURE__ */ new Set([
+  "INDEX.md",
+  "CONTEXT.md",
+  "CLAUDE.md",
+  "GEMINI.md",
+  "AGENTS.md",
+  "README.md"
+]);
 function withDiscoveryCache(storage) {
   const entries = /* @__PURE__ */ new Map();
   const discover = storage.discoverDocuments.bind(storage);
+  const readDoc = storage.readDocument.bind(storage);
+  const filtersRetired = !(storage instanceof FlatNestStorage);
   let generation = 0;
   storage.discoverDocuments = async (options = {}) => {
     const key = options.includeRetired || options.includeSuperseded ? "all" : "live";
     const hit = entries.get(key);
     if (hit && Date.now() - hit.ts < DISCOVERY_TTL_MS) return hit.docs;
+    const all = entries.get("all");
+    if (all && Date.now() - all.ts < DISCOVERY_TTL_MS) {
+      const docs2 = filtersRetired ? all.docs.filter(isLive) : all.docs;
+      entries.set("live", { docs: docs2, ts: all.ts });
+      return docs2;
+    }
     const startedAt = generation;
-    const docs = await discover(options);
-    if (generation === startedAt) entries.set(key, { docs, ts: Date.now() });
+    const crawled = await discover({ ...options, includeRetired: true });
+    const docs = key === "all" || !filtersRetired ? crawled : crawled.filter(isLive);
+    if (generation === startedAt) {
+      const ts = Date.now();
+      entries.set("all", { docs: crawled, ts });
+      entries.set(key, { docs, ts });
+    }
     return docs;
   };
   const invalidate = () => {
     generation++;
     entries.clear();
   };
-  for (const name of DOCUMENT_WRITERS) {
+  const patch = async (id) => {
+    generation++;
+    let node = null;
+    try {
+      node = await readDoc(id);
+    } catch (err) {
+      if (!(err instanceof DocumentNotFoundError)) {
+        invalidate();
+        return;
+      }
+      node = null;
+    }
+    for (const [key, entry] of entries) {
+      const docs = entry.docs.filter((d) => d.id !== id);
+      if (node && (key === "all" || isLive(node))) {
+        const at = docs.findIndex((d) => d.id > id);
+        docs.splice(at === -1 ? docs.length : at, 0, node);
+      }
+      entry.docs = docs;
+    }
+  };
+  const wrap = (name, after) => {
     const write = storage[name].bind(storage);
     storage[name] = async (...args) => {
       try {
         return await write(...args);
       } finally {
-        invalidate();
+        try {
+          await after(args);
+        } catch {
+          invalidate();
+        }
       }
     };
-  }
+  };
+  wrap("writeDocument", (args) => patch(String(args[0])));
+  wrap("deleteDocument", (args) => patch(String(args[0])));
+  wrap("init", () => invalidate());
+  wrap("writeVaultFile", (args) => {
+    const rel = String(args[0] ?? "");
+    const base = rel.split(/[/\\]/).pop() || "";
+    if (rel.endsWith(".md") && !DERIVED_VAULT_FILES.has(base)) invalidate();
+  });
   return { storage, invalidate };
 }
 var NestEngineCache = class {
@@ -1606,14 +1656,18 @@ async function removeTeamRefs(tx, teamId) {
 }
 async function resolveTeamRolesForUser(nestId, userId) {
   const refs = await listNestTeams(nestId).catch(() => []);
+  return resolveTeamRolesFromShared(refs, userId);
+}
+async function resolveTeamRolesFromShared(refs, userId) {
   if (refs.length === 0) return [];
-  const db = getDb();
+  const ids = [...new Set(refs.map((r) => r.teamId).filter(Boolean))];
+  if (ids.length === 0) return [];
+  const rows = await getDb().all(
+    `SELECT members FROM teams WHERE id IN (${ids.map(() => "?").join(",")})`,
+    ids
+  );
   const roles = /* @__PURE__ */ new Set();
-  for (const ref of refs) {
-    const row = await db.get("SELECT members FROM teams WHERE id = ?", [
-      ref.teamId
-    ]);
-    if (!row) continue;
+  for (const row of rows) {
     const member = parseMembers(row.members).find((m) => m.userId === userId);
     if (member) roles.add(member.role);
   }
@@ -1679,71 +1733,91 @@ var PERMISSION_LEVELS = {
   admin: 3,
   owner: 4
 };
-async function resolveNestPermission(nestId, userId) {
-  const db = getDb();
-  const nest = await db.get("SELECT user_id, visibility FROM nests WHERE id = ?", [nestId]);
-  if (!nest) return "none";
-  if (nest.user_id === userId) return "owner";
-  if (nest.user_id === ANON_USER_ID && await isLicenseAdminUserId(userId)) {
-    return "owner";
-  }
-  if (await isLicenseAdminUserId(userId)) return "admin";
-  const caller = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
-  if (caller?.email && isSuperAdmin(caller.email)) {
-    return "admin";
-  }
-  const higher = (a, b) => b && PERMISSION_LEVELS[b] > PERMISSION_LEVELS[a] ? b : a;
-  let best = "none";
-  const directGrant = await db.get(
-    "SELECT permission FROM nest_collaborators WHERE nest_id = ? AND user_id = ?",
-    [nestId, userId]
-  );
-  if (directGrant) best = higher(best, directGrant.permission);
-  if (best === "admin") return best;
-  for (const role of await resolveTeamRolesForUser(nestId, userId)) {
-    best = higher(best, teamRoleToPermission(role));
-  }
-  if (best === "admin") return best;
-  const stewardGrant = await db.get(
-    `SELECT 1 FROM stewards s
-         JOIN users u ON u.id = ?
-        WHERE s.nest_id = ? AND s.is_active = 1
-          AND LOWER(s.user_email) = LOWER(u.email)
-        LIMIT 1`,
-    [userId, nestId]
+var higher = (a, b) => b && PERMISSION_LEVELS[b] > PERMISSION_LEVELS[a] ? b : a;
+async function resolveNestAccess(nestId, userId) {
+  const row = await getDb().get(
+    `SELECT n.user_id      AS owner_id,
+            n.visibility   AS visibility,
+            n.shared_teams AS shared_teams,
+            u.email        AS caller_email,
+            nc.permission  AS collab_permission,
+            (SELECT 1 FROM stewards s
+               WHERE s.nest_id = n.id AND s.is_active = 1
+                 AND LOWER(s.user_email) = LOWER(u.email)
+               LIMIT 1) AS steward_hit,
+            (SELECT 1 FROM grants g
+               WHERE g.nest_id = n.id AND g.user_id = ?
+               LIMIT 1) AS grant_hit
+       FROM nests n
+       LEFT JOIN users u ON u.id = ?
+       LEFT JOIN nest_collaborators nc
+         ON nc.nest_id = n.id AND nc.user_id = ?
+      WHERE n.id = ?`,
+    [userId, userId, userId, nestId]
   );
-  if (stewardGrant) best = higher(best, "read");
-  if (nest.visibility === "public") best = higher(best, "read");
-  return best;
+  const absent = {
+    exists: false,
+    ownerId: null,
+    visibility: null,
+    callerEmail: null,
+    collaboratorPermission: null,
+    isSteward: false,
+    hasGrant: false,
+    permission: "none",
+    isPublicReader: false
+  };
+  if (!row) return absent;
+  const base = {
+    exists: true,
+    ownerId: row.owner_id,
+    visibility: row.visibility,
+    callerEmail: row.caller_email ?? null,
+    collaboratorPermission: row.collab_permission ?? null,
+    // Postgres returns integer 1, SQLite returns 1 — both truthy, neither a
+    // boolean, so normalize rather than leaking the driver's shape.
+    isSteward: !!row.steward_hit,
+    hasGrant: !!row.grant_hit
+  };
+  if (row.owner_id === userId) {
+    return { ...base, permission: "owner", isPublicReader: false };
+  }
+  const email = row.caller_email ?? null;
+  const licenseAdmin = isLicenseAdminEmail(email);
+  if (row.owner_id === ANON_USER_ID && licenseAdmin) {
+    return { ...base, permission: "owner", isPublicReader: false };
+  }
+  if (licenseAdmin || email && isSuperAdmin(email)) {
+    return { ...base, permission: "admin", isPublicReader: false };
+  }
+  let best = higher("none", row.collab_permission);
+  if (best !== "admin") {
+    const teamRoles = await resolveTeamRolesFromShared(
+      parseSharedTeams(row.shared_teams),
+      userId
+    );
+    for (const role of teamRoles) {
+      best = higher(best, teamRoleToPermission(role));
+    }
+    if (teamRoles.length > 0) {
+      return { ...base, permission: best, isPublicReader: false };
+    }
+  }
+  if (best === "admin") {
+    return { ...base, permission: best, isPublicReader: false };
+  }
+  if (base.isSteward) best = higher(best, "read");
+  if (row.visibility === "public") best = higher(best, "read");
+  const isPublicReader2 = row.visibility === "public" && !row.collab_permission && !base.isSteward;
+  return { ...base, permission: best, isPublicReader: isPublicReader2 };
+}
+async function resolveNestPermission(nestId, userId) {
+  return (await resolveNestAccess(nestId, userId)).permission;
 }
 function permissionLevel(p) {
   return PERMISSION_LEVELS[p] ?? 0;
 }
 async function isPublicReader(nestId, userId) {
-  const db = getDb();
-  const nest = await db.get("SELECT user_id, visibility FROM nests WHERE id = ?", [nestId]);
-  if (!nest) return false;
-  if (nest.visibility !== "public") return false;
-  if (nest.user_id === userId) return false;
-  const directGrant = await db.get(
-    "SELECT 1 FROM nest_collaborators WHERE nest_id = ? AND user_id = ?",
-    [nestId, userId]
-  );
-  if (directGrant) return false;
-  if (await isLicenseAdminUserId(userId)) return false;
-  const caller = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
-  if (caller?.email && isSuperAdmin(caller.email)) return false;
-  const stewardGrant = await db.get(
-    `SELECT 1 FROM stewards s
-         JOIN users u ON u.id = ?
-        WHERE s.nest_id = ? AND s.is_active = 1
-          AND LOWER(s.user_email) = LOWER(u.email)
-        LIMIT 1`,
-    [userId, nestId]
-  );
-  if (stewardGrant) return false;
-  if ((await resolveTeamRolesForUser(nestId, userId)).length > 0) return false;
-  return true;
+  return (await resolveNestAccess(nestId, userId)).isPublicReader;
 }
 
 // src/governance/tag-index-service.ts
@@ -2040,10 +2114,12 @@ async function listSharedNests(userId) {
        LEFT JOIN stewards s
          ON s.nest_id = n.id AND s.is_active = 1
         AND LOWER(s.user_email) = LOWER(u.email)
+       LEFT JOIN grants g
+         ON g.nest_id = n.id AND g.user_id = ?
        WHERE n.user_id != ?
-         AND (nc.user_id IS NOT NULL OR s.id IS NOT NULL)
+         AND (nc.user_id IS NOT NULL OR s.id IS NOT NULL OR g.id IS NOT NULL)
        ORDER BY n.created_at DESC`,
-    [userId, userId, userId]
+    [userId, userId, userId, userId]
   );
   const seen = new Set(direct.map((n) => n.id));
   for (const n of await nestsSharedViaTeams(userId)) {
@@ -2069,10 +2145,16 @@ async function listSharedNests(userId) {
   );
   return direct;
 }
-async function listVisibleNests(userId) {
+async function listVisibleNests(userId, opts = {}) {
   const db = getDb();
   const includeAnon = config.AUTH_MODE === "open" || await isServerAdminUserId(userId);
-  const params = includeAnon ? [userId, userId, userId, ANON_USER_ID] : [userId, userId, userId];
+  const params = [
+    userId,
+    userId,
+    ...opts.readable ? [userId] : [],
+    userId,
+    ...includeAnon ? [ANON_USER_ID] : []
+  ];
   const rows = await db.all(
     `SELECT DISTINCT n.* FROM nests n
        LEFT JOIN nest_collaborators nc
@@ -2081,9 +2163,11 @@ async function listVisibleNests(userId) {
        LEFT JOIN stewards s
          ON s.nest_id = n.id AND s.is_active = 1
         AND LOWER(s.user_email) = LOWER(u.email)
+       ${opts.readable ? "LEFT JOIN grants g ON g.nest_id = n.id AND g.user_id = ?" : ""}
       WHERE n.user_id = ?
          OR nc.user_id IS NOT NULL
          OR s.id IS NOT NULL
+         ${opts.readable ? "OR g.id IS NOT NULL OR n.visibility = 'public'" : ""}
          ${includeAnon ? "OR n.user_id = ?" : ""}
       ORDER BY n.created_at DESC`,
     params
@@ -2220,6 +2304,7 @@ export {
   canApproveWith,
   primaryRole,
   isServerAdminUserId,
+  resolveNestAccess,
   resolveNestPermission,
   permissionLevel,
   isPublicReader

package/dist/{chunk-D6HICFVW.js → chunk-UXJSO54R.js}

@@ -2,7 +2,7 @@ import {
   buildTitleMap,
   insertOrReplace,
   nowExpr
-} from "./chunk-L7UCMGWZ.js";
+} from "./chunk-SNFGU5Q7.js";
 import {
   getDb
 } from "./chunk-JMJLNEXE.js";

package/dist/{chunk-CLKZZZS2.js → chunk-YF4OFT2V.js}

@@ -11,7 +11,7 @@ import {
   resolveNestPermission,
   resolveTeamRolesForUser,
   sendEmailToRecipient
-} from "./chunk-L7UCMGWZ.js";
+} from "./chunk-SNFGU5Q7.js";
 import {
   ConflictError,
   ValidationError

package/dist/{grants-service-I535QVTW.js → grants-service-4NXPBYWD.js}

@@ -2,11 +2,11 @@ import {
   createGrant,
   deleteGrant,
   grantCoversNode,
-  hasAnyGrant,
+  grantRoleForNode,
   listGrants,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-OTGZQZKK.js";
+} from "./chunk-HWDPCPYT.js";
 import "./chunk-GUNJTORH.js";
 import "./chunk-JMJLNEXE.js";
 import "./chunk-SLTQACJW.js";
@@ -14,7 +14,7 @@ export {
   createGrant,
   deleteGrant,
   grantCoversNode,
-  hasAnyGrant,
+  grantRoleForNode,
   listGrants,
   listUserGrants,
   resolveNodeGrant